This toolkit translates the requirements of Kenya's Data Protection Act, 2019 and its subsidiary regulations into a working compliance programme — not simply an explanation of the law, but an implementation path any organisation can follow from registration through to a documented, auditable AI governance posture.
Each section pairs statutory citations with a practitioner note and an action checklist. This is a general compliance reference and internal planning tool, not legal advice — organisation-specific analysis should be obtained before acting on it.
Section 1 · Introduction, Purpose & Legal Framework
The primary statute is the Data Protection Act, 2019 (Act No. 24 of 2019), in force from 25 November 2019, giving effect to Article 31 of the Constitution. It is supplemented by the Data Protection (General) Regulations, 2021; the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, effective 14 July 2022; the Data Protection (Compliance and Enforcement) Regulations, 2021; the Data Protection (Conduct of Compliance Audit) Regulations, 2024; and sector- and topic-specific ODPC Guidance Notes.
The Act applies to controllers and processors established or ordinarily resident in Kenya, and — significantly — to foreign entities offering goods, services or online platforms to individuals in Kenya, reaching private companies of every size, public sector bodies, non-profits, and regulated sectors carrying heightened obligations (financial services, healthcare, education, telecommunications).
Section 25's core principles run through every other part of the toolkit: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability — the obligation to be able to demonstrate compliance, not merely assert it.
Section 2 · Registration with the ODPC
Under Section 18 and the Registration Regulations, no person may act as a data controller or processor without registering, with thresholds set by the ODPC based on industry, data volume and sensitivity. The seven-step registration path: confirm your status as controller, processor or both for each activity; assemble supporting documents (certificate of incorporation, KRA PIN, particulars of directors, description of processing); apply via the ODPC portal using form DPR1 (controllers) or DPR2 (processors) and pay the applicable fee; await review, typically resolved within 14 days; and diarise renewal, since a certificate is valid for 24 months. A Data Protection Officer must be designated where the organisation is a public body, processes sensitive personal data at scale, or its core activities require it.
Section 3 · Privacy Notices
The transparency obligation requires clear, plain-language disclosure at the point of collection covering ten mandatory elements: the controller's (and DPO's) identity and contact details; the specific purpose(s) of processing; the lawful basis relied upon for each purpose; categories of personal data collected, including any sensitive data; recipients or categories of recipients; whether data will leave Kenya and under what safeguards; the retention period or the criteria used to determine it; a summary of data subject rights and how to exercise them; the right to complain to the ODPC; and whether provision of the data is a statutory or contractual requirement.
A drafting and deployment checklist: plain, non-technical language (in Kiswahili where the audience warrants it); a layered structure with a short summary linking to the full notice; presentation before or at the point of collection, not buried in post-collection terms; a version-controlled "last updated" date; and review on every new processing purpose, system or third-party recipient.
Section 4 · Contracts & Third-Party Data Processing Agreements
A Data Processing Agreement is required wherever a third party — a payroll provider, cloud host, marketing platform or outsourced function — processes personal data on the organisation's behalf. The vendor due-diligence checklist confirms: the vendor's own ODPC (or equivalent offshore) registration status before onboarding; evidence of technical security controls; disclosed and assessed data residency and sub-processor locations; documented incident-response and breach-notification commitments with specific timeframes; and a data-protection re-assessment built into every contract renewal cycle.
Section 5 · Data Protection Impact Assessments (DPIAs)
A DPIA is mandatory under ODPC guidance wherever a project involves: systematic and extensive automated evaluation or profiling with legal or similarly significant effect; large-scale processing of sensitive personal data; systematic large-scale monitoring of a publicly accessible area; new technologies including AI or biometric systems where the risk profile is not yet well understood; large-scale processing of children's data; or matching/combining datasets in ways not reasonably anticipated by the data subject.
The DPIA process: describe the processing's nature, scope, context and purpose; assess necessity and proportionality; identify risks by likelihood and severity of harm; identify technical, organisational or design-level mitigations; consult the DPO and, where appropriate, affected data subjects; and document the outcome with senior sign-off before go-live. Where residual risk remains high after mitigation, the ODPC must be consulted before proceeding.
Section 6 · Data Subject Rights
The rights catalogue spans confirmation, access, rectification, erasure, restriction and objection. The DSAR handling protocol: log the request immediately, noting date received and channel; verify the requester's identity proportionately; confirm scope, clarifying ambiguous or broad requests; locate the relevant data across all systems, including backups where feasible; apply lawful exemptions (third-party data, legal privilege) narrowly and document the reasoning; respond within the statutory timeframe in an accessible format; and record completion in the DSAR register for audit purposes.
Section 7 · Technical & Organisational Security Measures
Technical controls: encryption of personal data at rest and in transit, particularly for sensitive personal data; role-based, least-privilege access control; multi-factor authentication for systems holding personal data; logging and monitoring of access, reviewed regularly; regular vulnerability scanning, patch management and penetration testing; secure, tested backup and disaster-recovery procedures; and anonymisation or pseudonymisation wherever the processing purpose can still be achieved.
Organisational controls: a documented information security policy reviewed at least annually; mandatory data protection and security awareness training, with role-specific modules for high-risk functions; clear-desk, clear-screen and device-management policies; prompt onboarding/offboarding access provisioning and revocation; vendor risk assessment prior to onboarding; and defined retention and secure-disposal schedules by data category. Security measures must be proportionate to the nature, scope, context and purpose of the processing and the risk it presents.
Section 8 · Breach Response
A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. A structured plan should set clear response timelines and define roles: an incident lead coordinating the overall response; IT/security containing the incident and leading technical investigation; the DPO/legal function assessing notification obligations and liaising with the ODPC; communications managing data subject and public-facing messaging; and an executive sponsor accountable for the organisation's overall remediation. Notification content should cover: the nature of the breach, including categories and approximate numbers of data subjects and records affected; the DPO's or other contact point's details; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects.
Section 9 · Cross-Border Data Transfers
The Act regulates transfers of personal data out of Kenya. Permitted mechanisms include: transfer to a jurisdiction the ODPC has recognised as providing adequate protection; the data subject's explicit, informed consent to the specific transfer; contractual safeguards, including Standard Contractual Clauses; Binding Corporate Rules for intra-group transfers; and other ODPC-approved safeguards or a narrow set of statutory exceptions (contract performance, public interest, legal claims). Cloud services, SaaS platforms, offshore support functions and group reporting lines are the most common sources of unplanned cross-border transfers, and the ODPC's Cloud Policy encourages data localisation for certain sensitive government and critical-infrastructure categories.
Section 10 · AI Governance
Kenya's existing DPA framework already reaches most AI use cases that process personal data — automated decision-making with significant effect on a data subject engages existing rights and DPIA obligations before any AI-specific statute is needed. A draft Artificial Intelligence Bill, introduced as a Senate Bill, proposes a risk-based regulatory regime modelled in part on the EU AI Act. An AI governance readiness checklist: maintain an inventory of AI systems processing personal data, including third-party and embedded vendor features; classify each system by risk level; complete a DPIA before deploying any system involving profiling, automated decisioning, or sensitive data; give affected individuals meaningful information about the logic, significance and consequences of automated decisions; build in a human review pathway for significant automated decisions; assess training-data provenance and minimise personal data used in training; and assign clear internal ownership for AI governance.
Section 11 · Master Compliance Checklist
A consolidated, assignable action list drawn from every section of the toolkit, organised across three tiers — foundational (registration, DPO, policy, ROPA); transparency & rights (privacy notices, DSAR handling, consent architecture); and contracts, risk & security (DPAs, DPIAs, TOMs, breach response, cross-border transfer mechanisms) — intended to be assigned to named owners with target dates and tracked to completion.
Section 12 · Selected ODPC & Court Determinations
The Act is increasingly tested and interpreted through published ODPC determinations and, on appeal or judicial review, by the High Court. This section curates case notes across five categories — registration, jurisdiction and procedure; ODPC determinations, appeals and enforcement; consent, notices and personal data in practice; data subject identity and digital identifiers; and AI governance — prepared by Muchangi Patrick & Co. Advocates to illustrate how the Act is applied in practice. See the firm's Case Law library for the full set of digests.
Section 13 · Appendix
The appendix closes the toolkit with key statutory definitions, ODPC regulatory contact details (Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi, and the ODPC's online registration and complaints portal at odpc.go.ke), advisory contact information for the preparing firm, an enforcement-context note (administrative fines of up to KES 5,000,000 or 1% of the controller's annual turnover, whichever is lower), and a document control record for version tracking.
